Sign up ×
Drupal Answers is a question and answer site for Drupal developers and administrators. It's 100% free, no registration required.

I want to disable the PHP Filter module on a large website, but going through all nodes, blocks and other fields where you could make possible use of the php filter would take eons.

Is there a simple way or method maybe by running SQL queries to find out where the php filter is used throughout my website?

share|improve this question

3 Answers 3

up vote 5 down vote accepted

Rather than re-inventing the wheel, just install the Security Review module, which has the following check:

PHP or Javascript in content (nodes and comments and fields in Drupal 7)

For blocks you can check the format column in the block_custom table.

The difficult one is Views - I've yet to find a reliable way to locate rogue PHP in Views programmatically.

share|improve this answer
I guess if Security Review guys wasn't able to add a reliable check for Views, it may be simply next thing to impossible. –  Mołot Apr 18 '14 at 11:03
@Mołot thanks, hadn't seen that issue –  Clive Apr 18 '14 at 11:16
@Mołot : Just found a way to retrieve views which has php enabled please see my answer below.. It will be great to know it has any downsides or edge cases... –  Anil Sagar Apr 18 '14 at 12:02
All I got is "OK Untrusted users do not have access to use the PHP input format." - with latest version. It got me green when I had a block with php input format on front page. Your answer seems to be simply untrue at the moment. –  Mołot Dec 2 '14 at 23:30
So, from what I can tell... the Security Review Module tells you that the php filter is being used... not what elements exactly are using it, which in a true security review would be helpful. This is however a good warning that further investigation is needed. –  General Redneck Dec 28 '14 at 4:23

You can able to find all views which have php enabled by running below command in MySQL...

SELECT , vd.display_options
FROM views_display AS vd
LEFT JOIN views_view AS vv ON vv.vid = vd.vid
WHERE vd.display_options REGEXP '.s:[3]+:"php".*'

views_display table stores this information in serialized format.... I have tested above query works as expected.. Hope it helps to solve the views PHP riddle :-)

share|improve this answer
Looks good. Would need to test it a bit. In the meantime I took liberty of editing and cleaned up the way you wrote the query (without touching it's logic, names etc of course). –  Mołot Apr 18 '14 at 12:05
Thank you :-) I just verified and i can able to see views which has php enabled.. Let's hope it works for OP too.. –  Anil Sagar Apr 18 '14 at 12:08
This doesn't work for all views (e.g. those defined in code), and that regex could easily produce false positives...better than nothing though I guess :) –  Clive Apr 18 '14 at 12:14

The code from Anil Sagar above only works if the view is saved in the database. If the view is only in code it won't work. So, I wrote a little snippet that I run to save all the views to the db. Then I can use the MySQL snippet to surface php.

  $views = views_get_all_views();
  foreach ($views as $view) {
    if (empty($view->disabled)) {
      drupal_set_message('view saved: ' . check_plain($view->name));
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.